ROSE  0.9.11.56
Classes | Functions
Rose::BinaryAnalysis::Partitioner2::Modules Namespace Reference

Description

Miscellaneous supporting functions for disassembly.

Classes

class  AddGhostSuccessors
 Follow basic block ghost edges. More...
 
class  BasicBlockSizeLimiter
 Callback to limit basic block size. More...
 
class  CfgGraphVizDumper
 Produce a GraphViz file for the CFG at a certain time. More...
 
class  Debugger
 Convenient place to attach a debugger. More...
 
class  HexDumper
 Produce a hexdump at a certain time. More...
 
class  InstructionLister
 List some instructions at a certain time. More...
 
class  MatchThunk
 Match thunk. More...
 
class  PreventDiscontiguousBlocks
 Prevent discontiguous basic blocks. More...
 

Functions

std::string canonicalFunctionName (const std::string &)
 Convert system function names to ROSE canonical form. More...
 
void demangleFunctionNames (const Partitioner &)
 Demangle all function names. More...
 
AddressIntervalSet deExecuteZeros (const MemoryMap::Ptr &map, size_t threshold, size_t leaveAtFront=16, size_t leaveAtBack=1)
 Remove execute permissions for zeros. More...
 
void nameStrings (const Partitioner &)
 Give labels to string constants. More...
 
void nameConstants (const Partitioner &)
 Gives names to constants in instructions. More...
 
std::vector< Function::PtrfindNoopFunctions (const Partitioner &)
 Find functions that are no-ops. More...
 
void nameNoopFunctions (const Partitioner &)
 Give names to functions that are no-ops. More...
 
SgAsmBlockbuildBasicBlockAst (const Partitioner &, const BasicBlock::Ptr &, const Function::Ptr &, const AstConstructionSettings &)
 Build AST for basic block. More...
 
SgAsmBlockbuildDataBlockAst (const Partitioner &, const DataBlock::Ptr &, const AstConstructionSettings &)
 Build AST for data block. More...
 
SgAsmFunctionbuildFunctionAst (const Partitioner &, const Function::Ptr &, const AstConstructionSettings &)
 Build AST for function. More...
 
SgAsmBlockbuildGlobalBlockAst (const Partitioner &, const AstConstructionSettings &)
 Builds the global block AST. More...
 
SgAsmBlockbuildAst (const Partitioner &, SgAsmInterpretation *interp=NULL, const AstConstructionSettings &settings=AstConstructionSettings::strict())
 Builds an AST from the CFG. More...
 
void fixupAstPointers (SgNode *ast, SgAsmInterpretation *interp=NULL)
 Fixes pointers in the AST. More...
 
void fixupAstCallingConventions (const Partitioner &, SgNode *ast)
 Fixes calling convention results. More...
 
void labelSymbolAddresses (Partitioner &, SgAsmGenericHeader *)
 Give labels to addresses that are symbols. More...
 
void labelSymbolAddresses (Partitioner &, SgAsmInterpretation *)
 Give labels to addresses that are symbols. More...
 
std::vector< Function::PtrfindSymbolFunctions (const Partitioner &, SgAsmGenericHeader *)
 Finds functions for which symbols exist. More...
 
std::vector< Function::PtrfindSymbolFunctions (const Partitioner &, SgAsmInterpretation *)
 Finds functions for which symbols exist. More...
 
size_t findSymbolFunctions (const Partitioner &, SgAsmGenericHeader *, std::vector< Function::Ptr > &)
 Finds functions for which symbols exist. More...
 

Function Documentation

std::string Rose::BinaryAnalysis::Partitioner2::Modules::canonicalFunctionName ( const std::string &  )

Convert system function names to ROSE canonical form.

ROSE always stores library function names as "function@library" with the reasoning that the function name is typically more important than the library name and storing them this way leads to better presentation in sorted lists. This function recognizes and converts the form "library.dll:function" and will convert "KERNEL32.dll:EncodePointer" to "EncodePointer@KERNEL32.dll"

See also
ModulesPe::systemFunctionName and possibly other OS-specific formatters.
void Rose::BinaryAnalysis::Partitioner2::Modules::demangleFunctionNames ( const Partitioner )

Demangle all function names.

Run the name demangler on all functions that have a non-empty name and no demangled name. Assign the result as each function's demangled name if it's different than the true name.

AddressIntervalSet Rose::BinaryAnalysis::Partitioner2::Modules::deExecuteZeros ( const MemoryMap::Ptr map,
size_t  threshold,
size_t  leaveAtFront = 16,
size_t  leaveAtBack = 1 
)

Remove execute permissions for zeros.

Scans memory to find consecutive zero bytes and removes execute permission from them. Only occurrences of at least threshold consecutive zeros are found, and only a subset of those occurrences have their execute permission removed. Namely, whenever an interval of addresses is found that contain all zeros, the interval is narrowed by eliminating the first few bytes (leaveAtFront) and last few bytes (leaveAtBack), and execute permissions are removed for this narrowed interval.

Returns the set of addresses whose access permissions were changed, which may be slightly fewer addresses than which contain zeros due to the leaveAtFront and leaveAtBack. The set of found zeros can be recovered from the return value by iterating over the intervals in the set and inserting the leaveAtFront and leaveAtBack addresses at each end of each interval.

If threshold is zero or the leaveAtFront and leaveAtBack sum to at least threshold then nothing happens.

void Rose::BinaryAnalysis::Partitioner2::Modules::labelSymbolAddresses ( Partitioner ,
SgAsmGenericHeader  
)

Give labels to addresses that are symbols.

Scans the specified binary container and labels those virtual addresses that correspond to symbols. This function does not create any functions in the partitioner, it only gives names to certain addresses. If the same address is labeled more than once by symbols with different names then one name is chosen arbitrarily.

void Rose::BinaryAnalysis::Partitioner2::Modules::labelSymbolAddresses ( Partitioner ,
SgAsmInterpretation  
)

Give labels to addresses that are symbols.

Scans the specified binary container and labels those virtual addresses that correspond to symbols. This function does not create any functions in the partitioner, it only gives names to certain addresses. If the same address is labeled more than once by symbols with different names then one name is chosen arbitrarily.

void Rose::BinaryAnalysis::Partitioner2::Modules::nameStrings ( const Partitioner )

Give labels to string constants.

Finds integer constants that are the address if a C-style NUL-terminated ASCII string and adds a comment to the constant (if it had none previously) to describe the string. All instructions that are attached to the CFG/AUM are processed. The instructions are modified by attaching the comment, but the comments are not added to the partitioners address name map.

std::vector<Function::Ptr> Rose::BinaryAnalysis::Partitioner2::Modules::findSymbolFunctions ( const Partitioner ,
SgAsmGenericHeader  
)

Finds functions for which symbols exist.

Scans the specified AST to find symbols that point to functions and makes a function at each such address. A function is made only if an instruction can be disassembled at the address. The return value is a sorted list of unique functions.

std::vector<Function::Ptr> Rose::BinaryAnalysis::Partitioner2::Modules::findSymbolFunctions ( const Partitioner ,
SgAsmInterpretation  
)

Finds functions for which symbols exist.

Scans the specified AST to find symbols that point to functions and makes a function at each such address. A function is made only if an instruction can be disassembled at the address. The return value is a sorted list of unique functions.

size_t Rose::BinaryAnalysis::Partitioner2::Modules::findSymbolFunctions ( const Partitioner ,
SgAsmGenericHeader ,
std::vector< Function::Ptr > &   
)

Finds functions for which symbols exist.

Scans the specified AST to find symbols that point to functions and makes a function at each such address. A function is made only if an instruction can be disassembled at the address. The return value is a sorted list of unique functions.

void Rose::BinaryAnalysis::Partitioner2::Modules::nameConstants ( const Partitioner )

Gives names to constants in instructions.

Scans the entire list of attached instructions and give each constant integer expression a name if the value of the expression happens to be an address that has a name.

std::vector<Function::Ptr> Rose::BinaryAnalysis::Partitioner2::Modules::findNoopFunctions ( const Partitioner )

Find functions that are no-ops.

Finds functions that are no-ops and returns them in ascending order of entry addresses.

void Rose::BinaryAnalysis::Partitioner2::Modules::nameNoopFunctions ( const Partitioner )

Give names to functions that are no-ops.

Scans the list of attached functions to find those whose only action is to return to the caller (via findNoopFunctions) and gives names to those that don't have names. The names are of the form "noop_ADDR() -> void" where ADDR is the hexadecimal entry address. The C++ trailing return type syntax is used so that functions can be easily sorted according to their names.

SgAsmBlock* Rose::BinaryAnalysis::Partitioner2::Modules::buildBasicBlockAst ( const Partitioner ,
const BasicBlock::Ptr ,
const Function::Ptr ,
const AstConstructionSettings  
)

Build AST for basic block.

Builds and returns an AST for the specified basic block. The basic block must not be a null pointer, but it need not be in the CFG.

SgAsmBlock* Rose::BinaryAnalysis::Partitioner2::Modules::buildDataBlockAst ( const Partitioner ,
const DataBlock::Ptr ,
const AstConstructionSettings  
)

Build AST for data block.

Builds and returns an AST for the specified data block. The data block must not be a null pointer, but it need not be in the CFG.

SgAsmFunction* Rose::BinaryAnalysis::Partitioner2::Modules::buildFunctionAst ( const Partitioner ,
const Function::Ptr ,
const AstConstructionSettings  
)

Build AST for function.

Builds and returns an AST for the specified function. The function must not be a null pointer, but it need not be in the CFG. The function will have children created only for its basic blocks that exist in the CFG (otherwise the partitioner doesn't know about them).

SgAsmBlock* Rose::BinaryAnalysis::Partitioner2::Modules::buildGlobalBlockAst ( const Partitioner ,
const AstConstructionSettings  
)

Builds the global block AST.

A global block's children are all the functions contained in the AST, which in turn contain SgAsmBlock IR nodes for the basic blocks, which in turn contain instructions.

SgAsmBlock* Rose::BinaryAnalysis::Partitioner2::Modules::buildAst ( const Partitioner ,
SgAsmInterpretation interp = NULL,
const AstConstructionSettings settings = AstConstructionSettings::strict() 
)

Builds an AST from the CFG.

Builds an abstract syntax tree from the control flow graph. The returned SgAsmBlock will have child functions; each function (SgAsmFunction) will have child basic blocks; each basic block (SgAsmBlock) will have child instructions.

This function is the same as buildGlobalBlockAst except it also calls various AST fixup functions. Providing an interpretation allows more fixups to occur. Also, if interp is non-null then the returned global block is attached to the interpretation in the AST (any previous global block is detached but not destroyed).

void Rose::BinaryAnalysis::Partitioner2::Modules::fixupAstPointers ( SgNode ast,
SgAsmInterpretation interp = NULL 
)

Fixes pointers in the AST.

Traverses the AST to find SgAsmIntegerValueExpressions and changes absolute values to relative values. If such an expression is the starting address of a function then the expression will point to that function; else if the expression is the starting address of a basic block then the expression will point to that basic block; else if the expression is the starting address of an instruction then the expression will point to that instruction; else if the expression evaluates to an address inside a mapped section, then the expression will become relative to the start of the best section. Pointers into sections are only created if an interpretation is specified.

void Rose::BinaryAnalysis::Partitioner2::Modules::fixupAstCallingConventions ( const Partitioner ,
SgNode ast 
)

Fixes calling convention results.

This function uses the results of previous calling convention analysis to assign calling convention definitions to the functions in the specified AST. There's often more than one definition that matches the analysis results, and this fixup pass attempts to assign the best definitions. It does so by first ranking the definitions according to how often they match across all the functions known to the partitioner. Then, for each function in the specified ast, the we also get a list matching definitions (if a calling convention analysis has been run on that function). We copy into the AST that function's definition which has the highest global ranking.